Use an Identity Provider (IdP)

Log in to your IdP console and download the IdP metadata XML. Optionally, if your IdP supports metadata URL, you can copy the metadata URL instead of the XML.

Copy the IdP metadata XML or URL to the Ops Manager Use an Identity Provider login page.

Note: The same IdP metadata URL or XML is applied for the BOSH Director. If you use a separate IdP for BOSH, copy the metadata XML or URL from that IdP and enter it into the BOSH IdP Metadata text box in the Ops Manager login page.

Enter values for the fields listed below. Failure to provide values in these fields results in a 500 error.

Note: These attributes are case-sensitive.

SAML admin group: Enter the name of the SAML group that contains all Ops Manager administrators.

SAML groups attribute: Enter the groups attribute tag name with which you configured the SAML server.

Enter your Decryption passphrase. Read the End User License Agreement, and select the checkbox to accept the terms.

Security Group ID: Enter the Group ID of the pcf-vms-security-group you created for your PCF VMs in the Step 6: Configure a Security Group for PCF VMs section of the Installing PCF on AWS Manually topic. Locate the Group ID in the Security Groups tab of your EC2 Dashboard.

Key Pair Name: Enter pcf-ops-manager-key.

SSH Private Key: Open the AWS key pair pcf-ops-manager-keys.pem file you generated in the Step 3: Create an IAM User for PCF section of the Installing PCF on AWS Manually topic. Copy the contents of the .pem file and paste it into the SSH Private Key field.

Region: Select the region where you deployed Ops Manager.

Encrypt EBS Volumes: Select this checkbox to enable full encryption on persistent disks of all BOSH-deployed VMs except the Ops Manager VM and Director VM. See the Configuring Amazon EBS Encryption for PCF on AWS topic for details about using EBS encryption.

Note: Enabling EBS encryption only encrypts Linux VMs. The Windows VMs deployed with Pivotal Application Service (PAS) for Windows or PAS for Windows 2012R2 are not encrypted.

Click Save.

Step 3: Director Config Page

Select Director Config.

Enter at least two of the following NTP servers in the NTP Servers (comma delimited) field, separated by a comma: 0.amazon.pool.ntp.org,1.amazon.pool.ntp.org,2.amazon.pool.ntp.org,3.amazon.pool.ntp.org

Note: The NTP server configuration only updates after VM recreation. Ensure that you select the Recreate all VMs checkbox if you modify the value of this field.

Leave the JMX Provider IP Address field blank.

Note: Starting from PCF v2.0, BOSH-reported component metrics are available in the Loggregator Firehose by default. Therefore, if you continue to use PCF JMX Bridge for consuming them outside of the Firehose, you may receive duplicate data. To prevent this, leave the JMX Provider IP Address field blank. For additional guidance, see BOSH System Metrics Available in Loggregator Firehose.

Leave the Bosh HM Forwarder IP Address field blank.

Note: Starting from PCF v2.0, BOSH-reported component metrics are available in the Loggregator Firehose by default. Therefore, if you continue to use the BOSH HM Forwarder for consuming them, you may receive duplicate data. To prevent this, leave the Bosh HM Forwarder IP Address field blank. For additional guidance, see BOSH System Metrics Available in Loggregator Firehose.

Select the Enable VM Resurrector Plugin checkbox to enable the Ops Manager Resurrector functionality and increase Pivotal Application Service (PAS) availability. For more information, see the Using Ops Manager Resurrector on VMware vSphere topic.

Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

Note: You must enable post-deploy scripts to install PKS.

Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

Select Enable bosh deploy retries if you want Ops Manager to retry failed BOSH operations up to five times.

(Optional) Disable Allow Legacy Agents if all of your tiles have stemcells v3468 or later. Disabling the field will allow Ops Manager to implement TLS secure communications.

Select Keep Unreachable Director VMs if you want to preserve BOSH Director VMs after a failed deployment for troubleshooting purposes.

For CredHub Encryption Provider, you can choose whether BOSH CredHub stores its encryption key internally on the BOSH Director and CredHub VM, or in an external hardware security module (HSM). The HSM option is more secure.

Internal: Select this option for internal CredHub key storage. This option is selected by default and requires no additional configuration.

Luna HSM: Select this option to use a SafeNet Luna HSM as your permanent CredHub encryption provider, and fill in the following fields:

Encryption Key Name: Any name to identify the key that the HSM uses to encrypt and decrypt the CredHub data. Changing this key name after you deploy Ops Manager can cause service downtime.

Provider Partition: The partition that stores your encryption key. Changing this partition after you deploy Ops Manager could cause service downtime. For this value and the ones below, use values gathered in Preparing CredHub HSMs for Configuration.

Provider Partition Password

Provider Client Certificate: The certificate that validates the identity of the HSM when CredHub connects as a client.

Provider Client Certificate Private Key

HSM Host Address

HSM Port Address: If you do not know your port address, enter 1792.

Partition Serial Number

HSM Certificate: The certificate that the HSM presents to CredHub to establish a two-way mTLS connection.

Select a Blobstore Location to either configure the blobstore as an internal server or an external endpoint. Because the internal server is unscalable and less secure, Pivotal recommends that you configure an external blobstore.

Note: After you deploy Ops Manager, you cannot change the blobstore location.

Internal: Select this option to use an internal blobstore. Ops Manager creates a new VM for blob storage. No additional configuration is required.

S3 Compatible Blobstore: Select this option to use an external S3-compatible endpoint. When you have created an S3 bucket, complete the following steps:

Locate the endpoint for your region in the Amazon Simple Storage Service (S3) table and construct a URL using your region’s endpoint. For example, if you are using the us-west-2 region, the URL you create would be https://s3-us-west-2.amazonaws.com. Enter this URL into the S3 Endpoint field.

On a command line, run ssh ubuntu@OPS-MANAGER-FQDN to SSH into the Ops Manager VM. Replace OPS-MANAGER-FQDN with the fully qualified domain name of Ops Manager.

Copy the custom public CA certificate you used to sign the S3 endpoint into /etc/ssl/certs on the Ops Manager VM.

On the Ops Manager VM, run sudo update-ca-certificates -f -v to import the custom CA certificate into the Ops Manager VM truststore.

Note: You must also add this custom CA certificate into the Trusted Certificates field in the Security page. See Security Page for instructions.

GCS Blobstore: Select this option to use an external GCS endpoint. To create a GCS bucket, you must have a GCS account. Follow the procedures in Creating Storage Buckets in the GCS documentation to create a GCS bucket. When you have created a GCS bucket, complete the following steps:

Bucket Name: Enter the name of your GCS bucket.

Storage Class: Select the storage class for your GCS bucket. See Storage Classes in the GCP documentation for more information.

Service Account Key: Follow the steps in the Set up an IAM Service Account section of Preparing to Deploy Ops Manager on GCP Manually to download a JSON file with a private key. Enter the contents of the JSON file into the field.

For Database Location, select External MySQL Database and complete the following steps:

From the AWS Console, navigate to the RDS Dashboard.

Select Instances, then click the arrow to the left of your instance and select the second icon to display the Details information.

Refer to the following table to retrieve the values for the Director Config page:

RDS Instance Field

BOSH Director Field

Endpoint

Host

Port

Port, which is 3306.

DB Name

Database, which is bosh.

Username

Username

For Password, enter the password that you defined for your MySQL database when you created in the Step 19: Create a MySQL Database using AWS RDS section of the Installing PCF on AWS Manually topic.
In addition, if you selected the Enable TLS for Director Database checkbox, you can fill out the following optional fields:

Enable TLS: Selecting this checkbox enables TLS communication between the BOSH Director and the database.

TLS CA: Enter the Certificate Authority for the TLS Certificate.

TLS Certificate: Enter the client certificate for mutual TLS connections to the database.

Advanced DB Connection Options: If you would like to provide additional options for the database, use this field to provide a JSON-formatted options string.

(Optional) Director Workers sets the number of workers available to execute Director tasks. This field defaults to 5.

(Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. For AWS, the default value is 6. Leave this field blank to use this default value. Pivotal recommends that you use the default value unless doing so results in rate limiting or errors on your IaaS.

WARNING: In Ops Manager v2.2.7 and earlier, if you change the Director Hostname after your initial deployment, you can cause downtime. Changing the hostname triggers all VMs to be recreated. This issue is resolved in Ops Manager v2.2.8 and later.

(Optional) Enter your list of comma-separated Excluded Recursors to declare which IP addresses and ports should not be used by the DNS server.

(Optional) To disable BOSH DNS, select the Disable BOSH DNS server for troubleshooting purposes checkbox. For more information about the BOSH DNS service discovery mechanism, see BOSH DNS Enabled by Default in the Ops Manager v2.2 Release Notes.

Step 5: Create Networks Page

Perform the following steps to add the network configuration that you created for your VPC in the
Create a VPC section of Installing PCF on AWS Manually.
Record your VPC CIDR if you set a CIDR other than the recommendation!

Click Add Network.

For Name, enter infrastructure.

Create a subnet for each availability zone by clicking Add Subnet. Refer to the table below for the information required to create all three subnets:

FirstSubnet

VPC Subnet ID

pcf-infrastructure-subnet-az0

CIDR

10.0.16.0/28

Reserved IP Ranges

10.0.16.0-10.0.16.4

DNS

10.0.0.2*

Gateway

10.0.16.1

Availability Zones

REGION-#a. For example, us-west-2a.

SecondSubnet

VPC Subnet ID

pcf-infrastructure-subnet-az1

CIDR

10.0.16.16/28

Reserved IP Ranges

10.0.16.16-10.0.16.20

DNS

10.0.0.2*

Gateway

10.0.16.17

Availability Zones

REGION-#b. For example, us-west-2b

ThirdSubnet

VPC Subnet ID

pcf-infrastructure-subnet-az2

CIDR

10.0.16.32/28

Reserved IP Ranges

10.0.16.32-10.0.16.36

DNS

10.0.0.2*

Gateway

10.0.16.33

Availability Zones

REGION-#c. For example, us-west-2c

* If you set a VPC CIDR other than recommended, enter the second IP in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.

Click Add Network.

For Name, enter the name of your runtime. For example, pas.

Create a subnet for each availability zone by clicking Add Subnet. See the table below for the information required to create all three subnets:

FirstSubnet

VPC Subnet ID

pcf-pas-subnet-az0

CIDR

10.0.4.0/24

Reserved IP Ranges

10.0.4.0-10.0.4.4

DNS

10.0.0.2*

Gateway

10.0.4.1

Availability Zones

REGION-#a. For example, us-west-2a

SecondSubnet

VPC Subnet ID

pcf-pas-subnet-az1

CIDR

10.0.5.0/24

Reserved IP Ranges

10.0.5.0-10.0.5.4

DNS

10.0.0.2*

Gateway

10.0.5.1

Availability Zones

REGION-#b. For example, us-west-2b

ThirdSubnet

VPC Subnet ID

pcf-pas-subnet-az2

CIDR

10.0.6.0/24

Reserved IP Ranges

10.0.6.0-10.0.6.4

DNS

10.0.0.2*

Gateway

10.0.6.1

Availability Zones

REGION-#c. For example, us-west-2c

* If you set a VPC CIDR other than recommended, enter the second IP in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.

Click Add Network.

For Name, enter services.

Create a subnet for each availability zone by clicking Add Subnet. Refer to the table below for the information required to create all three subnets:

FirstSubnet

VPC Subnet ID

pcf-services-subnet-az0

CIDR

10.0.8.0/24

Reserved IP Ranges

10.0.8.0-10.0.8.3

DNS

10.0.0.2*

Gateway

10.0.8.1

Availability Zones

REGION-#a. For example, us-west-2a.

SecondSubnet

VPC Subnet ID

pcf-services-subnet-az1

CIDR

10.0.9.0/24

Reserved IP Ranges

10.0.9.0-10.0.9.3

DNS

10.0.0.2*

Gateway

10.0.9.1

Availability Zones

REGION-#b. For example, us-west-2b.

ThirdSubnet

VPC Subnet ID

pcf-services-subnet-az2

CIDR

10.0.10.0/24

Reserved IP Ranges

10.0.10.0-10.0.10.3

DNS

10.0.0.2*

Gateway

10.0.10.1

Availability Zones

REGION-#c. For example, us-west-2c.

* If you set a VPC CIDR other than recommended, enter the second IP in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.

Click Save.

Note: If you are deploying PKS with a PKS workload load balancer,
you must tag each AWS subnet with your PKS Kubernetes cluster unique identifier before you create the load balancer.
For more information about tagging subnets with a PKS cluster unique identifier,
see AWS Prerequisites.

Note: If you want to use Docker Registries for running app instances in Docker containers, enter the certificate for your private Docker Registry in this field. See Using Docker Registries for more information on running app instances in PAS using Docker Registries.

Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

Step 8: Syslog Page

(Optional) Select Yes to send BOSH Director system logs to a remote server.

In the Address field, enter the IP address or DNS name for the remote server.

In the Port field, enter the port number that the remote server listens on.

In the Transport Protocol dropdown menu, select TCP, UDP, or RELP. This selection determines which transport protocol is used to send the logs to the remote server.

(Optional) Pivotal strongly recommends that you enable TLS encryption when forwarding logs as they may contain sensitive information. For example, these logs may contain cloud provider credentials. To enable TLS, perform the following steps.

In the Permitted Peer field, enter either the name or SHA1 fingerprint of the remote peer.

In the SSL Certificate field, enter the SSL certificate for the remote server.

Click Save.

Step 9: Resource Config Page

Select Resource Config.

Adjust any values as necessary for your deployment. Under the Instances, Persistent Disk Type, and VM Type fields,
choose Automatic from the dropdown to allocate the recommended resources for the job. If the Persistent Disk Type field reads None, the job does not require persistent disk space.

Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the new recommended allocation.

Note: If you install PAS for Windows, provision your Master Compilation Job
with at least 128 GB of disk space.

(Optional) Enter your AWS target group name in the Load Balancers column for each job. Prepend the name with alb:. For example, enter alb:target-group-name.
To create an Application Load Balancer (ALB) and target group, follow the procedures in Getting Started with Application Load Balancers in the AWS documentation. Then navigate to Target Groups in the EC2 Dashboard menu to find your target group Name.

Note: To configure an ALB, you must have the following AWS IAM permissions.